9:08 a.m.
-----Original Message-----
From: Chakra Divi [mailto:chakragithub@gmail.com]
Sent: Tuesday, November 9, 2021 7:53 PM
To: devel(a)lists.nfs-ganesha.org
Subject: [NFS-Ganesha-Devel] mount subdirectories under an export dir with acls
and root_squash is enabled
Hi Team,
I'm trying to mount a sub-directory under an export dir which is throwing
permission denied when root squash is enabled even though it has root
permissions. I have added acls on the export directory - which is sending an
fsal_access call to my fsal layer with anonymous_uid so getting permission
denied from my layer. I'm using ganesha v3-stable version. Am i missing anything
? Do i need make any change to allow mount only operation to use uids instead
of anon uids
typo in above issue, issue is seen when using v2.3-stable version of nfs-ganesha
Could you give more information on your configuration and the setup of the export
directory? As Daniel said, it sounds like working as designed. The root_squash option
causes any client root credential to be squashed to anon_uid/anon_gid.
What kind of ACLs are you using? It sounds like you have your own FSAL, can you share any
details?
Reading the above more carefully, I think you are asking about clients mounting a
sub-directory of the export and perhaps the issue is that anon_uid/anon_gid doesn't
have permission to access the export, just the specific sub-directories. You need to
either give read-execute permission to the directory (for NFSv4 we can't distinguish
between a LOOKUP that is part of a client mount command and a LOOKUP that is part of a
post-mount client operation) or another option would be to create exports for each
sub-directory so that the export directory only exists in the PseudoFS in which case the
real export directory can have any permission desired so long as Ganesha itself has
access.
Also, strongly suggest moving to a more supported version of Ganesha, V2.3 is VERY old.
V3.5 is the current supported release with V4.0 coming by end of year (possibly by end of
November). V4-rc2 is available for non-production testing.
Frank